Ethernet II Frame - Header Format and EtherType Decoding
Ethernet II is the common Ethernet frame format used to carry network-layer protocols. Its two-byte EtherType field is the key difference analysts use to identify the payload.
Key Takeaways
Ethernet II header is 14 bytes without VLAN tags.
EtherType values identify payload protocols.
Values at or above the Ethernet II threshold represent protocol type rather than length.
VLAN tags insert additional bytes before the inner EtherType.
Ethernet II header fields
The Ethernet II header contains destination MAC address, source MAC address, and EtherType. The payload follows, usually containing IPv4, IPv6, ARP, or another network-layer payload.
EtherType decoding
EtherType is a two-byte field. Common values identify IPv4, ARP, IPv6, and VLAN-tagged frames. Correct EtherType decoding determines which parser should handle the next bytes.
Ethernet II vs generic Ethernet
Many searchers use “Ethernet frame” broadly, but Ethernet II specifically uses EtherType for payload identification. That makes it especially relevant to packet decoding tools.
Practical Reference
| Item | Value | Analysis Note |
|---|---|---|
| Header size | 14 bytes | Destination MAC, source MAC, EtherType. |
| Payload indicator | EtherType | Tells what comes next. |
| VLAN case | Tagged frame | Adds a tag before inner EtherType. |
| Analyzer path | Ethernet -> IP/ARP | Use EtherType to continue. |
FAQ
Is Ethernet II still common?
Yes. Ethernet II framing is widely used on modern local networks and in packet captures.
How do I know the payload is IPv4?
In Ethernet II, check EtherType. The IPv4 EtherType value indicates the payload begins with an IPv4 header.